@intentius/chant-lexicon-docker 0.124.30 → 0.124.32

package/dist/lint/post-synth/apt-update-alone.js

@@ -0,0 +1,34 @@
+/**
+ * DKRD020: apt-get update in its own RUN
+ *
+ * A RUN that only runs `apt-get update` is cached as its own layer, so a
+ * later `apt-get install` in another RUN can install from a stale package
+ * index. Update and install in the same RUN.
+ */
+import { commandText, eachDockerfile, stageLabel } from "./docker-helpers.js";
+const UPDATE = /\bapt(-get)?\s+update\b/;
+const INSTALL = /\bapt(-get)?\s+(install|upgrade|dist-upgrade)\b/;
+export const dkrd020 = {
+    id: "DKRD020",
+    description: "apt-get update in a different RUN from apt-get install — the install can use a stale package index",
+    check(ctx) {
+        const diagnostics = [];
+        for (const { fileName, parsed } of eachDockerfile(ctx.outputs)) {
+            for (const stage of parsed.stages) {
+                const runs = stage.instructions.filter((i) => i.instruction === "RUN");
+                const updateAt = runs.findIndex((r) => UPDATE.test(commandText(r)) && !INSTALL.test(commandText(r)));
+                if (updateAt === -1)
+                    continue;
+                if (!runs.slice(updateAt + 1).some((r) => INSTALL.test(commandText(r))))
+                    continue;
+                diagnostics.push({
+                    checkId: "DKRD020",
+                    severity: "warning",
+                    message: `${fileName} ${stageLabel(stage)}: apt-get update runs in its own RUN, and a later RUN installs from that cached index. Run update and install in one RUN: apt-get update && apt-get install -y --no-install-recommends ...`,
+                    lexicon: "docker",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cache-busting-copy.js

@@ -0,0 +1,61 @@
+/**
+ * DKRD013: Whole build context copied before installing dependencies
+ *
+ * `COPY . .` followed by a dependency install (npm ci, pip install -r,
+ * go mod download, ...) in the same stage invalidates the install layer on
+ * every source change. Copy the dependency manifests first, install, then
+ * copy the rest.
+ */
+import { commandText, eachDockerfile, instrText, stageLabel } from "./docker-helpers.js";
+/** Installs whose inputs are a few manifest files rather than the whole source tree. */
+const INSTALL = [
+    /\bnpm\s+(ci|install|i)(\s+--?[\w-]+(=\S+)?)*\s*($|&&|;|\|)/m,
+    /\byarn(\s+install)?(\s+--[\w-]+)*\s*($|&&|;|\|)/m,
+    /\bpnpm\s+(install|i)\b/,
+    /\bbun\s+install\b/,
+    /\bpip3?\s+install\b[^&;|]*\s-r\s/,
+    /\bpoetry\s+install\b/,
+    /\buv\s+sync\b/,
+    /\bpipenv\s+install\b/,
+    /\bgo\s+mod\s+download\b/,
+    /\bbundle\s+install\b/,
+    /\bcomposer\s+install\b/,
+    // A string, not a regex literal: the egress scan reads a bare `fetch` in code as a call.
+    new RegExp("\\bcargo\\s+fetch\\b"),
+    /\bdotnet\s+restore\b/,
+    /\bmvn\b[^&;|]*\bdependency:go-offline\b/,
+];
+/** `COPY . <dest>` (or `./`) from the build context, not from another stage. */
+function copiesWholeContext(value) {
+    const words = value.split(/\s+/).filter((w) => w.length > 0);
+    if (words.some((w) => w.startsWith("--from")))
+        return false;
+    const args = words.filter((w) => !w.startsWith("--"));
+    if (args[0]?.startsWith("["))
+        return false;
+    return args.slice(0, -1).some((src) => src === "." || src === "./");
+}
+export const dkrd013 = {
+    id: "DKRD013",
+    description: "Whole build context copied before a dependency install — every source change re-runs the install",
+    check(ctx) {
+        const diagnostics = [];
+        for (const { fileName, parsed } of eachDockerfile(ctx.outputs)) {
+            for (const stage of parsed.stages) {
+                const copyAt = stage.instructions.findIndex((i) => i.instruction === "COPY" && copiesWholeContext(i.value));
+                if (copyAt === -1)
+                    continue;
+                const install = stage.instructions.slice(copyAt + 1).find((i) => i.instruction === "RUN" && INSTALL.some((re) => re.test(commandText(i))));
+                if (!install)
+                    continue;
+                diagnostics.push({
+                    checkId: "DKRD013",
+                    severity: "warning",
+                    message: `${fileName} ${stageLabel(stage)}: ${instrText(stage.instructions[copyAt])} comes before ${instrText(install)}, so any source change re-runs the install. Copy the dependency manifests first, run the install, then copy the rest.`,
+                    lexicon: "docker",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/copy-from-stage.js

@@ -0,0 +1,53 @@
+/**
+ * DKRD016: COPY --from names no earlier stage
+ *
+ * `COPY --from=<name>` reads from an earlier stage with that name (or
+ * index). A name that only a later stage has, or that no stage has, is
+ * pulled as an image instead, which is almost never what was meant.
+ */
+import { eachDockerfile, stageLabel } from "./docker-helpers.js";
+/** Looks like an image reference rather than a stage name: has a tag, digest or registry path. */
+function looksLikeImage(ref) {
+    return /[:/@]/.test(ref);
+}
+export const dkrd016 = {
+    id: "DKRD016",
+    description: "COPY --from names a stage that is not defined before it",
+    check(ctx) {
+        const diagnostics = [];
+        for (const { fileName, parsed } of eachDockerfile(ctx.outputs)) {
+            for (const stage of parsed.stages) {
+                for (const instr of stage.instructions) {
+                    if (instr.instruction !== "COPY" && instr.instruction !== "ADD")
+                        continue;
+                    const m = instr.value.match(/--from=(\S+)/);
+                    if (!m)
+                        continue;
+                    const ref = m[1];
+                    if (ref.includes("$"))
+                        continue;
+                    const earlier = parsed.stages.slice(0, stage.index);
+                    if (/^\d+$/.test(ref)) {
+                        if (Number(ref) < stage.index)
+                            continue;
+                    }
+                    else if (earlier.some((s) => s.as?.toLowerCase() === ref.toLowerCase())) {
+                        continue;
+                    }
+                    const later = parsed.stages.slice(stage.index).find((s) => s.as?.toLowerCase() === ref.toLowerCase() || String(s.index) === ref);
+                    if (!later && looksLikeImage(ref))
+                        continue;
+                    diagnostics.push({
+                        checkId: "DKRD016",
+                        severity: "warning",
+                        message: later
+                            ? `${fileName} ${stageLabel(stage)}: ${instr.instruction} --from=${ref} names ${stageLabel(later)}, which is not defined until later. Move that stage before this one.`
+                            : `${fileName} ${stageLabel(stage)}: ${instr.instruction} --from=${ref} names no stage, so Docker pulls an image called "${ref}". Name an earlier stage, or give the image a tag.`,
+                        lexicon: "docker",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/docker-helpers.js

@@ -0,0 +1,148 @@
+/**
+ * Shared YAML traversal utilities for Docker post-synth checks.
+ */
+export { getPrimaryOutput } from "@intentius/chant/lint/post-synth";
+import { splitDockerfileInstructions } from "../../import/parser.js";
+/**
+ * Extract services section from serialized docker-compose.yml.
+ */
+export function extractServices(yaml) {
+    const services = new Map();
+    const servicesIdx = yaml.search(/^services:\s*$/m);
+    if (servicesIdx === -1)
+        return services;
+    const afterServices = yaml.slice(servicesIdx + yaml.slice(servicesIdx).indexOf("\n") + 1);
+    // Stop at next top-level key
+    const endMatch = afterServices.search(/^[a-z]/m);
+    const servicesContent = endMatch === -1 ? afterServices : afterServices.slice(0, endMatch);
+    // Split by service entries (2-space indent + name:)
+    const sections = servicesContent.split(/\n(?=  [a-z][a-z0-9_-]*:)/);
+    for (const section of sections) {
+        const nameMatch = section.match(/^\s{2}([a-z][a-z0-9_-]*):/);
+        if (!nameMatch)
+            continue;
+        const name = nameMatch[1];
+        const svc = { name };
+        const imageMatch = section.match(/^\s{4}image:\s+(.+)$/m);
+        if (imageMatch)
+            svc.image = imageMatch[1].trim().replace(/^['"]|['"]$/g, "");
+        const portsMatch = section.match(/^\s{4}ports:\n((?:\s{6}- .+\n?)+)/m);
+        if (portsMatch) {
+            svc.ports = [];
+            for (const line of portsMatch[1].split("\n")) {
+                const item = line.match(/^\s{6}-\s+['"]?(.+?)['"]?$/);
+                if (item)
+                    svc.ports.push(item[1].trim());
+            }
+        }
+        const volsMatch = section.match(/^\s{4}volumes:\n((?:\s{6}- .+\n?)+)/m);
+        if (volsMatch) {
+            svc.volumes = [];
+            for (const line of volsMatch[1].split("\n")) {
+                const item = line.match(/^\s{6}-\s+['"]?(.+?)['"]?$/);
+                if (item)
+                    svc.volumes.push(item[1].trim());
+            }
+        }
+        services.set(name, svc);
+    }
+    return services;
+}
+/**
+ * Extract named volumes from the top-level volumes: section.
+ */
+export function extractNamedVolumes(yaml) {
+    const volumes = new Set();
+    const volumesIdx = yaml.search(/^volumes:\s*$/m);
+    if (volumesIdx === -1)
+        return volumes;
+    const afterVolumes = yaml.slice(volumesIdx + yaml.slice(volumesIdx).indexOf("\n") + 1);
+    const endMatch = afterVolumes.search(/^[a-z]/m);
+    const volumesContent = endMatch === -1 ? afterVolumes : afterVolumes.slice(0, endMatch);
+    for (const line of volumesContent.split("\n")) {
+        const match = line.match(/^\s{2}([a-z][a-z0-9_-]*):/);
+        if (match)
+            volumes.add(match[1]);
+    }
+    return volumes;
+}
+/**
+ * Check if an image tag represents :latest or is untagged.
+ */
+export function isLatestOrUntagged(image) {
+    if (!image || image.startsWith("${"))
+        return false;
+    if (image.endsWith(":latest"))
+        return true;
+    const parts = image.split("/");
+    const lastPart = parts[parts.length - 1];
+    return !lastPart.includes(":") && !lastPart.includes("@");
+}
+/**
+ * Get Dockerfile content from SerializerResult files map.
+ */
+export function extractDockerfiles(output) {
+    const files = new Map();
+    if (typeof output !== "object" || output === null)
+        return files;
+    if (!("files" in output))
+        return files;
+    const outputFiles = output.files;
+    for (const [name, content] of Object.entries(outputFiles)) {
+        if (name.startsWith("Dockerfile")) {
+            files.set(name, content);
+        }
+    }
+    return files;
+}
+/** A Dockerfile's global ARGs and stages, each stage's instructions in order. */
+export function parseDockerfileStages(content) {
+    const out = { globalArgs: [], stages: [] };
+    for (const instr of splitDockerfileInstructions(content)) {
+        if (instr.instruction === "FROM") {
+            const words = instr.value.split(/\s+/).filter((w) => !w.startsWith("--"));
+            const asAt = words.findIndex((w) => w.toLowerCase() === "as");
+            out.stages.push({
+                index: out.stages.length,
+                from: words[0] ?? "",
+                ...(asAt > 0 && words[asAt + 1] ? { as: words[asAt + 1] } : {}),
+                instructions: [],
+            });
+        }
+        else if (out.stages.length > 0) {
+            out.stages[out.stages.length - 1].instructions.push(instr);
+        }
+        else if (instr.instruction === "ARG") {
+            out.globalArgs.push(instr);
+        }
+    }
+    return out;
+}
+/** How a stage is named in a message: `stage "build"` or `stage 2`. */
+export function stageLabel(stage) {
+    return stage.as ? `stage "${stage.as}"` : `stage ${stage.index + 1}`;
+}
+/** The first line of an instruction, for a message. */
+export function instrText(instr) {
+    const first = instr.value.split("\n")[0].replace(/\s*\\$/, "");
+    return `${instr.instruction} ${first}`;
+}
+/** Whether a USER value is root (by name or uid 0, with or without a group). */
+export function isRootUser(value) {
+    const user = value.trim().split(":")[0];
+    return user === "root" || user === "0";
+}
+/** Every generated Dockerfile in a build's outputs, parsed. */
+export function eachDockerfile(outputs) {
+    const out = [];
+    for (const [, output] of outputs) {
+        for (const [fileName, content] of extractDockerfiles(output)) {
+            out.push({ fileName, content, parsed: parseDockerfileStages(content) });
+        }
+    }
+    return out;
+}
+/** A RUN value with its line continuations joined, for matching commands. */
+export function commandText(instr) {
+    return instr.value.replace(/\\[ \t]*\n/g, " ");
+}

package/dist/lint/post-synth/index.js

@@ -0,0 +1,30 @@
+import { dkrd001 } from "./no-latest-image.js";
+import { dkrd002 } from "./unused-volume.js";
+import { dkrd003 } from "./ssh-port-exposed.js";
+import { dkrd010 } from "./apt-no-recommends.js";
+import { dkrd011 } from "./prefer-copy.js";
+import { dkrd012 } from "./no-root-user.js";
+import { dkrd013 } from "./cache-busting-copy.js";
+import { dkrd014 } from "./root-after-user.js";
+import { dkrd015 } from "./repeated-cmd.js";
+import { dkrd016 } from "./copy-from-stage.js";
+import { dkrd017 } from "./unused-global-arg.js";
+import { dkrd018 } from "./relative-workdir.js";
+import { dkrd019 } from "./add-url-checksum.js";
+import { dkrd020 } from "./apt-update-alone.js";
+export const postSynthChecks = [
+    dkrd001,
+    dkrd002,
+    dkrd003,
+    dkrd010,
+    dkrd011,
+    dkrd012,
+    dkrd013,
+    dkrd014,
+    dkrd015,
+    dkrd016,
+    dkrd017,
+    dkrd018,
+    dkrd019,
+    dkrd020,
+];

package/dist/lint/post-synth/no-latest-image.js

@@ -0,0 +1,30 @@
+/**
+ * DKRD001: No Latest Image Tag
+ *
+ * Detects services using :latest or untagged images in docker-compose.yml.
+ */
+import { getPrimaryOutput, extractServices, isLatestOrUntagged } from "./docker-helpers.js";
+export const dkrd001 = {
+    id: "DKRD001",
+    description: "Service uses :latest or untagged image — specify an explicit version tag",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_outputName, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            if (!yaml)
+                continue;
+            const services = extractServices(yaml);
+            for (const [name, svc] of services) {
+                if (svc.image && isLatestOrUntagged(svc.image)) {
+                    diagnostics.push({
+                        checkId: "DKRD001",
+                        severity: "warning",
+                        message: `Service "${name}" uses image "${svc.image}" which is :latest or untagged. Use an explicit version tag for reproducible builds.`,
+                        lexicon: "docker",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/no-root-user.js

@@ -0,0 +1,35 @@
+/**
+ * DKRD012: No Root User
+ *
+ * Warns when the container would run as root: the final stage has no USER
+ * instruction, or its last USER is root. USER in an earlier stage does not
+ * carry into the final image.
+ */
+import { eachDockerfile, isRootUser, stageLabel } from "./docker-helpers.js";
+export const dkrd012 = {
+    id: "DKRD012",
+    description: "Dockerfile's final stage has no USER instruction, or ends on USER root — container runs as root",
+    check(ctx) {
+        const diagnostics = [];
+        for (const { fileName, parsed } of eachDockerfile(ctx.outputs)) {
+            const final = parsed.stages[parsed.stages.length - 1];
+            if (!final)
+                continue;
+            const users = final.instructions.filter((i) => i.instruction === "USER");
+            const last = users[users.length - 1];
+            let message;
+            if (!last) {
+                const anyUser = parsed.stages.some((s) => s.instructions.some((i) => i.instruction === "USER"));
+                message = anyUser
+                    ? `${fileName}: The final ${stageLabel(final)} has no USER instruction; a USER in an earlier stage does not carry over. The container will run as root. Add a USER step to the final stage.`
+                    : `${fileName}: No USER instruction found. The container will run as root. Add a USER instruction to improve security.`;
+            }
+            else if (isRootUser(last.value)) {
+                message = `${fileName}: The final ${stageLabel(final)} ends on USER ${last.value.trim()}, so the container runs as root. Switch to an unprivileged USER after the root setup steps.`;
+            }
+            if (message)
+                diagnostics.push({ checkId: "DKRD012", severity: "warning", message, lexicon: "docker" });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/prefer-copy.js

@@ -0,0 +1,43 @@
+/**
+ * DKRD011: Prefer COPY over ADD
+ *
+ * ADD has surprising behavior (auto-extracts archives, fetches URLs).
+ * Use COPY when you just need to copy local files.
+ */
+import { extractDockerfiles } from "./docker-helpers.js";
+function looksLikeUrl(src) {
+    return src.startsWith("http://") || src.startsWith("https://") || src.startsWith("ftp://");
+}
+function looksLikeArchive(src) {
+    return /\.(tar|tar\.gz|tgz|tar\.bz2|tar\.xz|zip)$/i.test(src);
+}
+export const dkrd011 = {
+    id: "DKRD011",
+    description: "Prefer COPY over ADD when not fetching URLs or extracting archives",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_outputName, output] of ctx.outputs) {
+            const dockerfiles = extractDockerfiles(output);
+            for (const [fileName, content] of dockerfiles) {
+                const lines = content.split("\n");
+                for (const line of lines) {
+                    const trimmed = line.trim();
+                    if (/^ADD\s+/.test(trimmed)) {
+                        // Extract src argument (first token after ADD)
+                        const parts = trimmed.replace(/^ADD\s+/, "").split(/\s+/);
+                        const src = parts[0];
+                        if (!looksLikeUrl(src) && !looksLikeArchive(src)) {
+                            diagnostics.push({
+                                checkId: "DKRD011",
+                                severity: "info",
+                                message: `${fileName}: Use COPY instead of ADD when not fetching URLs or extracting archives. ADD "${src}" could be COPY.`,
+                                lexicon: "docker",
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/relative-workdir.js

@@ -0,0 +1,34 @@
+/**
+ * DKRD018: Relative WORKDIR
+ *
+ * A relative WORKDIR resolves against whatever directory the base image
+ * left, which can change with the image. Use an absolute path, at least for
+ * the first WORKDIR of a stage.
+ */
+import { eachDockerfile, stageLabel } from "./docker-helpers.js";
+export const dkrd018 = {
+    id: "DKRD018",
+    description: "Relative WORKDIR before any absolute WORKDIR in the stage",
+    check(ctx) {
+        const diagnostics = [];
+        for (const { fileName, parsed } of eachDockerfile(ctx.outputs)) {
+            for (const stage of parsed.stages) {
+                for (const instr of stage.instructions) {
+                    if (instr.instruction !== "WORKDIR")
+                        continue;
+                    const dir = instr.value.trim().replace(/^["']|["']$/g, "");
+                    if (dir.startsWith("/") || dir.startsWith("$") || /^[A-Za-z]:[\\/]/.test(dir))
+                        break;
+                    diagnostics.push({
+                        checkId: "DKRD018",
+                        severity: "warning",
+                        message: `${fileName} ${stageLabel(stage)}: WORKDIR ${dir} is relative to the base image's working directory. Use an absolute path.`,
+                        lexicon: "docker",
+                    });
+                    break;
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/repeated-cmd.js

@@ -0,0 +1,30 @@
+/**
+ * DKRD015: More than one CMD or ENTRYPOINT in a stage
+ *
+ * Only the last CMD and the last ENTRYPOINT of a stage take effect; the
+ * earlier ones are silently ignored.
+ */
+import { eachDockerfile, instrText, stageLabel } from "./docker-helpers.js";
+export const dkrd015 = {
+    id: "DKRD015",
+    description: "More than one CMD or ENTRYPOINT in a stage — only the last one takes effect",
+    check(ctx) {
+        const diagnostics = [];
+        for (const { fileName, parsed } of eachDockerfile(ctx.outputs)) {
+            for (const stage of parsed.stages) {
+                for (const kw of ["CMD", "ENTRYPOINT"]) {
+                    const all = stage.instructions.filter((i) => i.instruction === kw);
+                    if (all.length < 2)
+                        continue;
+                    diagnostics.push({
+                        checkId: "DKRD015",
+                        severity: "warning",
+                        message: `${fileName} ${stageLabel(stage)}: ${all.length} ${kw} instructions; only the last (${instrText(all[all.length - 1])}) takes effect. Remove the others.`,
+                        lexicon: "docker",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/root-after-user.js

@@ -0,0 +1,39 @@
+/**
+ * DKRD014: Root-only command after a non-root USER
+ *
+ * A RUN that installs packages or manages users and ownership (apt-get,
+ * apk add, useradd, chown, ...) fails or misbehaves after USER switches to
+ * an unprivileged user. Run root setup first, then switch USER.
+ */
+import { commandText, eachDockerfile, instrText, isRootUser, stageLabel } from "./docker-helpers.js";
+const ROOT_ONLY = /(^|[\s;&|(])(apt-get\s+(install|update|upgrade|dist-upgrade|remove|purge)|apt\s+(install|update|upgrade)|apk\s+(add|update|upgrade|del)|yum\s+(install|update)|dnf\s+(install|update|upgrade)|microdnf\s+install|zypper\s+(install|in|refresh)|useradd|adduser|groupadd|addgroup|usermod|chown)\b/;
+export const dkrd014 = {
+    id: "DKRD014",
+    description: "RUN needs root but comes after USER switched to a non-root user",
+    check(ctx) {
+        const diagnostics = [];
+        for (const { fileName, parsed } of eachDockerfile(ctx.outputs)) {
+            for (const stage of parsed.stages) {
+                let user;
+                for (const instr of stage.instructions) {
+                    if (instr.instruction === "USER") {
+                        user = instr.value.trim();
+                        continue;
+                    }
+                    if (instr.instruction !== "RUN" || user === undefined || isRootUser(user))
+                        continue;
+                    const cmd = commandText(instr);
+                    if (/\bsudo\b/.test(cmd) || !ROOT_ONLY.test(cmd))
+                        continue;
+                    diagnostics.push({
+                        checkId: "DKRD014",
+                        severity: "warning",
+                        message: `${fileName} ${stageLabel(stage)}: ${instrText(instr)} needs root but runs as USER ${user}. Move it before the USER step, or switch to USER root for it.`,
+                        lexicon: "docker",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/ssh-port-exposed.js

@@ -0,0 +1,58 @@
+/**
+ * DKRD003: SSH Port Exposed
+ *
+ * Detects services exposing port 22 (SSH) on the host.
+ * Exposing SSH externally is a security risk.
+ */
+import { getPrimaryOutput, extractServices } from "./docker-helpers.js";
+function exposesSshPort(port) {
+    // Formats: "22", "22/tcp", "0.0.0.0:22:22", "127.0.0.1:22:22", "host:container"
+    const normalized = port.trim();
+    const parts = normalized.split(":");
+    if (parts.length === 1) {
+        // Just a port number: "22" or "22/tcp"
+        const portNum = parts[0].split("/")[0];
+        return portNum === "22";
+    }
+    if (parts.length === 2) {
+        // "hostPort:containerPort" e.g. "22:22" — no IP binding, accessible on all interfaces
+        const hostPort = parts[0].split("/")[0];
+        return hostPort === "22";
+    }
+    if (parts.length >= 3) {
+        // "ip:hostPort:containerPort" e.g. "127.0.0.1:22:22" or "0.0.0.0:22:22"
+        const ip = parts[0];
+        const hostPort = parts[1].split("/")[0];
+        // Only flag if port is 22 AND not bound to loopback
+        if (hostPort !== "22")
+            return false;
+        return ip !== "127.0.0.1" && ip !== "::1" && ip !== "localhost";
+    }
+    return false;
+}
+export const dkrd003 = {
+    id: "DKRD003",
+    description: "Service exposes SSH port (22) externally — this is a security risk",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_outputName, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            if (!yaml)
+                continue;
+            const services = extractServices(yaml);
+            for (const [name, svc] of services) {
+                for (const port of svc.ports ?? []) {
+                    if (exposesSshPort(port)) {
+                        diagnostics.push({
+                            checkId: "DKRD003",
+                            severity: "error",
+                            message: `Service "${name}" exposes SSH port 22 externally (port mapping: "${port}"). This is a security risk.`,
+                            lexicon: "docker",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/unused-global-arg.js

@@ -0,0 +1,34 @@
+/**
+ * DKRD017: ARG before FROM that nothing uses
+ *
+ * An ARG declared before the first FROM is only visible to FROM lines, and
+ * to stages that declare it again (`ARG NAME`). One that neither uses does
+ * nothing.
+ */
+import { eachDockerfile } from "./docker-helpers.js";
+export const dkrd017 = {
+    id: "DKRD017",
+    description: "ARG before the first FROM is not used by any FROM or stage",
+    check(ctx) {
+        const diagnostics = [];
+        for (const { fileName, content, parsed } of eachDockerfile(ctx.outputs)) {
+            const fromLines = content.split("\n").filter((l) => /^\s*FROM\s/i.test(l)).join("\n");
+            for (const arg of parsed.globalArgs) {
+                const name = arg.value.trim().split("=")[0].trim();
+                if (!name)
+                    continue;
+                const used = new RegExp(`\\$\\{?${name}\\b`).test(fromLines);
+                const redeclared = parsed.stages.some((s) => s.instructions.some((i) => i.instruction === "ARG" && i.value.trim().split("=")[0].trim() === name));
+                if (used || redeclared)
+                    continue;
+                diagnostics.push({
+                    checkId: "DKRD017",
+                    severity: "warning",
+                    message: `${fileName}: ARG ${name} is declared before FROM but no FROM uses it and no stage declares it again with ARG ${name}. Use it, declare it in the stage that needs it, or remove it.`,
+                    lexicon: "docker",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};